Yep, could do that. Question is whether we should actually return `clone`d `scriptlet.Cookie` objects to be safe with state.